Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

471–480 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#471

Post by psychphysic »

guenthert wrote: post #401
psychphysic wrote: post #337

Earlier quoted context omitted.

It makes sense if you want to move from two factor authentication to just the second factor while making it seem new and cool? It seems to be smoke and mirrors for you register a bunch of TPM/HSM.

Don't be so quick to dismiss it. Afaiu, (one of) the problems they intend to address is the (all too common) case of breach of security at the server where large number of passwords are stolen. The public part of a passkey, i.e. the one stored on the server, is worthless to an adversary.

I think it's a great change but I am critical of the way it's being marketed.

Re: Passkeys: The beginning of the end of the password

#473

Post by cultureswitch »

internetter wrote: post #397
mastazi wrote: post #386

Earlier quoted context omitted.

So it's like a private key but you can't access or manage it, as it's owned by Google/Apple/Microsoft? How convenient!

My reaction as well. From Google's FAQ: > Passkeys created on Android are backed up and synced with Android devices that are signed in to the same Google Account, in the same way as passwords are backed up to the password manager. I don't like this. Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration. I certainly don't like the lack of emphasis on…

The thing with these authentication services is that if Google doesn't like you and blocks your account, you're fucked.

This is not a remote possibility. It happens to thousands of people every day, for entirely frivolous reasons.

Until there is some authentication system that is genuinely robust to corporate control attacks, I'll keep using the imperfect password manager model.

Re: Passkeys: The beginning of the end of the password

#474

Post by vinay_ys »

voxic11 wrote: post #197
michaelt wrote: post #192

Earlier quoted context omitted.

The article says "Instead, passkeys let users sign in to apps and sites the same way they unlock their devices: with a fingerprint, a face scan or a screen lock PIN." Does that not rather imply that, if I log in with faceid on an iphone, my login will be tied to my ability to faceid on an iphone, and hence only available on iphones and macs? As a user, that's sounding a lot like platform lock-in to me. And as a devel…

No passkeys are just normal private keys. You can store those private keys in a particular platform's secure key store which on phones can be decrypted/made usable when you unlock the device. But there is nothing stopping you from transferring these keys to a different device if you wish.

This is incorrect. Passkeys on iOS and Android are locked to Apple and Google account ecosystem. They cannot leave their ecosystem. Also, only the OS platform can use the BLE transport for CTAP2 protocol on iOS and Android devices. That is, a 3rdparty app (like 1password) cannot implement a FIDO2 BLE or NFC authenticator on iOS and Android – which is a huge handicap.

Re: Passkeys: The beginning of the end of the password

#475

Post by Phemist »

JohnFen wrote: post #387
Phemist wrote: post #335

Argh. Passwords are amazing. I loathe many of the attempts at replacing them simply because the _average_ user has proven to be unable to manage them. The three factors of authentication are a thing because they all protect against somewhat orthogonal threat vectors. Possession "have" is nice because it binds the authentication to a single thing in the real world (as opposed to some digital thing that can be copied e…

> we need to work on fusing all the factor-types into a single strong 3-factor auth Would this not make logging into things three times more painful? Even just using 2FA is a pain right now.

This is another hot take, the word factor is overloaded (by marketing people) to be really confusing.

The three factors of auth are categories / types. TOTP, password-entry into a form, biometric presentation, etc are _measures_. Sometimes the first measure is not sufficient, because it only implements one factor-type (e.g. the secret knowledge password), and a second measure that like TOTP is necessary which proves possession of something to a degree.

The time between proving one measure and then the next 2"F"A measure allows many shenanigans (e.g. social engineering to get me to send a TOTP code to my down-on-his-luck "son").

What I am professing is a focus on measures where proof of all three factor types happens at the same time.

PIN codes as entered to unlock a private key on a smartcard, which is then used to sign some other thing, would be one example of a 2-factor measure. Another is FaceID/TouchID (on-device matching).

But 3-factor measures are not impossible - e.g., take also the keystroke dynamics into account of a password being entered on a specific device, apple could implement "KeystrokeID".

Other options can exist, it just takes some creativity to think of how a secret behaviour can be encoded into a biometric modality that is then only understood by a specific device..

Re: Passkeys: The beginning of the end of the password

#476

Post by vinay_ys »

Passkeys as implemented by Apple/Google has serious limitations – your credentials are locked into their platform and tied to their online account (iCloud account or Google account). They won't let you use your phone as a FIDO2 authenticator via 3rdparty apps (like 1Password or Bitwarden). Your credentials are only as secure and reliable as their online account services are, and they are subject all the risks of state/corp spying, forced logins at cross-border transits etc.

The dangers of this are quite clear – if you get banned or locked out from your iCloud account or Google account (this is known to happen – with no appeals process), then you lose access to all your passkeys immediately. If you are forced to reveal your Google or iCloud account credentials under threat, you have effectively handed over all your credentials. There is no way to disable cloud syncing of your credentials.

By not allowing 3rdparty apps to speak BLE/NFC CTAP2 protocol on their phones, they are effectively crippling the phone you bought and paid for to be tied to their online platform more deeply.

They have turned a supposedly open standard that is FIDO2 authenticator (as described in the white paper) into a platform-lockin product called Passkey.

One excuse for this could be that there are risks to giving 3rdparty apps permission to speak raw BLE/NFC. But that doesn't need to be the case – CTAP2 authenticator protocol could be a platform component and it could be its own specific permission that can be given to apps that qualify it (there are special privileged api permissions like that today in platform already).

Re: Passkeys: The beginning of the end of the password

#477

Post by iamthemonster »

jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

How quickly they will be adopted will be almost completely determined by how convenient they are to the user, not how secure they are.

Re: Passkeys: The beginning of the end of the password

#478

Post by t0suj4 »

jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

From what I've understood it's a TOTP without the air gap of user typing the code manually.

Re: Passkeys: The beginning of the end of the password

#480

Post by jacquesm »

This is just a way to tie your identity more closely to your account, it doesn't make anything more or less secure. Every big silo is trying to do this constantly and once you recognize the pattern you'll see it everywhere. Never mind the inconvenience to the users, all that matters is that you are known to the system wherever you are and on whatever device you are using so that your profile can be closely matched to your various interests and intents the better to sell advertising (or your data, depending on the operator).

My recommendation: get a yubikey that you wear on your keyring, it's not as cheap as a password but it adds another layer of security without an even closer tie to you as a person, you can usually associate more than one yubikey with an account which gives you a way to diffuse ownership of the account without tying it to a particular computer or phone. And stay away from biometrics if you can.

Post reply on HN